The timeline for a quantum attack on Bitcoin’s cryptography is shrinking, moving from a vague distant threat to a probable 5-to-10 year window. On What Bitcoin Did, Alex Pruden estimated a 50% chance a relevant machine emerges by 2033, with 2029 as a plausible early outlier.
Google’s Willow paper demonstrated below-threshold error correction, and an Oratomic paper theorized an attack architecture needing only 10,000 physical qubits - a collapse from previous million-qubit estimates. “This doesn't just mean we are walking toward the goal; the goal is moving toward us,” Pruden argued.
"Google’s recent Willow paper changed the math. Researchers demonstrated below-threshold error correction, proving that adding physical qubits can actually reduce system errors."
- Alex Pruden, What Bitcoin Did
The threat isn't just to dormant coins. Roughly 6 million BTC, including Satoshi's, are stored with exposed public keys. But the existential risk is a “fast-clock” machine that can derive a private key in under ten minutes, enabling an “on-spend” attack to front-run transactions from the mempool. On Bankless, Nic Carter warned this breaks the fundamental assumption that knowing a key equals owning the money.
Developers are scrambling for solutions. Blockstream’s Jonas Nick is pitching “Shrimps,” a stateful post-quantum signature scheme where signatures are 350 bytes on a primary device but balloon to 8 kilobytes if state is lost. This trades localized user risk for systemic network efficiency.
Conduition highlighted isogeny-based cryptography as an alternative that preserves Bitcoin features like BIP32 derivation, though verification is 50 times slower than Schnorr. On Stacker News Live, the argument was that the community must start testing now, as a rushed, panicked migration would turn the mempool into a riot.
"The threat isn't a sudden, quiet drain of all wallets. It is the market panic that precedes it. If a government-scale actor builds a functional quantum computer, they only need to trigger a 'mad dash for the exit' to break the network’s liquidity."
- Stacker News Live
Starkware’s Ava Hu Levy proposed “Quantum Safe Bitcoin,” a scheme using hash puzzles that works within current Bitcoin script, albeit with $150 fees and requiring direct miner transmission. Bitcoin And host David Bennett argued this is still preferable to a fork that would lack the original chain’s hash rate.
Bitcoin’s greatest vulnerability may be social, not technical. Carter warned on Bankless that Bitcoin’s governance, built for peacetime and doing nothing, is spectacularly unsuited to the total mobilization required. He predicts that if the community can’t coordinate, major custodians like BlackRock and Coinbase will dictate a canonical fork, likely burning Satoshi’s coins to protect market value. The race is no longer just against physics, but against Bitcoin’s own inability to act.
